A UTM is deployed on the external edge of the main corporate office. The office connects to the WAN port of the edge router. The edge router at the main office connects to the remote offices using GRE IPSec tunnels. A network administrator notices that a worm that was not detected by the UTM has spread from the remote sites into the corporate network. The UTM currently has traffic rules applied that should block the port used by the worm. Which of the following steps would MOST likely correct this issue?
A) Move the UTM onto the LAN side of the network
B) Enable TLS inspection on the UTM
C) Enable stateful inspection on the UTM
D) Configure the UTM to deny encrypted files from being transferred

Question

Quizplus · Accepted Answer

Stateful inspection tracks the state of network connections and uses this information to make decisions about whether to allow or deny traffic. In this case, enabling stateful inspection on the UTM would allow it to detect and block the worm traffic, even if the worm is using encryption to evade detection.

A UTM Is Deployed on the External Edge of the Main